Prerequisites
- An API key for the workspace. Only an API key (or a client-credentials
token) may set
metadataandend_user_idon a task. - An MCP server over Streamable HTTP that verifies the
tool call context.
@agentarea/toolsdoes this for TypeScript; any server can follow the reference. - Two different random values: a static credential, and a signing secret of at least 32 characters.
Steps
Serve the tools
With
@agentarea/tools, give the server both values and the instance id it
will be registered under (audience). Until you know the id, start with
audience unset and add it after the next step.Connect it with a signing secret
context_secret is write-only: it goes to the secret manager and is never
sent to the server or returned.id as the server’s audience. To add or rotate the
secret on an existing instance, PATCH .../mcp-server-instances/{instance_id}
with {"context_secret": "..."}; null removes it.Verify
Stream the task and look for progress and the structured result:tool.progress per notification (at most two a second per call)
and a tool.result whose data.structured_content is {"rows": 23}. On the
server, ctx.signed is true.
Troubleshooting
The tool fails with rejected the credentials (HTTP 401)
The tool fails with rejected the credentials (HTTP 401)
Either the static credential is wrong, or the context token was refused:
a different secret on each side,
audience set to something other than the
instance id, or issuer other than agentarea. The server’s log names the
failing check.The server says missing x-agentarea-context header
The server says missing x-agentarea-context header
The instance has no
context_secret, so AgentArea sends no context. Read
the instance: json_spec.context_signing must be true.metadata and end_user_id can only be set with an API key (403)
metadata and end_user_id can only be set with an API key (403)
The task was created from a signed-in browser session. Create it with an API
key.
The server runs inside your cluster or on localhost
The server runs inside your cluster or on localhost
Private and cluster-internal addresses are refused unless the operator lists
them in
AGENTAREA_HTTP_PRIVATE_ALLOWLIST on the API and the worker, for
example orders.apps.svc.cluster.local or 10.0.4.17/32. There is no
per-workspace switch: whoever can create an instance could otherwise reach
every internal service.Related
MCP tool call context
Every key, claim, rejection and limit
Stream task events
Read tool.progress and tool.result live